crans
/
ansible
mirror of http://gitlab.adm.crans.org/nounous/ansible.git
19
0
Fork 0
Code Issues Projects Releases Wiki Activity

pleasing erdnaxe and yamllint

certbot_on_virtu
_shirenn 2021-12-04 21:55:14 +01:00
parent a8bf67f18e
commit afbc9f2b58
77 changed files with 170 additions and 174 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
.yamllint.yml
View File

@ -2,6 +2,5 @@
extends: default extends: default
rules: rules:
line-length: line-length: disable
level: warning
... ...

1
group_vars/all/network_interfaces.yml
View File

@ -1,3 +1,4 @@
---
glob_network_interfaces: glob_network_interfaces:
vlan: vlan:
- name: srv - name: srv

1
group_vars/cachan/network_interfaces.yml
View File

@ -1,3 +1,4 @@
---
glob_network_interfaces: glob_network_interfaces:
vlan: vlan:
- name: cachan_srv - name: cachan_srv

2
group_vars/dhcp.yml
View File

@ -7,7 +7,7 @@ glob_dhcp:
glob_service_dhcp: glob_service_dhcp:
name: dhcp name: dhcp
install_dir: /var/local/services/dhcp install_dir: /var/local/services/dhcp
generated: yes generated: true
cron: cron:
frequency: "*/2 * * * *" frequency: "*/2 * * * *"
options: -q options: -q

1
group_vars/dovecot.yml
View File

@ -1,3 +1,4 @@
---
glob_dovecot: glob_dovecot:
ldap: ldap:
uri: "ldap://{{ query('ldap', 'ip', 're2o-ldap', 'adm') | ipv4 | first }}/" uri: "ldap://{{ query('ldap', 'ip', 're2o-ldap', 'adm') | ipv4 | first }}/"

1
group_vars/ethercalc.yml
View File

@ -1,2 +1,3 @@
---
glob_ethercalc: glob_ethercalc:
ip: "{{ query('ldap', 'ip', ansible_hostname, 'adm') | ipv4 | first }}" ip: "{{ query('ldap', 'ip', ansible_hostname, 'adm') | ipv4 | first }}"

1
group_vars/etherpad.yml
View File

@ -1,3 +1,4 @@
---
glob_etherpad: glob_etherpad:
instances: instances:
- name: etherpad-lite - name: etherpad-lite

1
group_vars/firewall.yml
View File

@ -1,3 +1,4 @@
---
glob_service_firewall: glob_service_firewall:
name: firewall name: firewall
install_dir: /var/local/services/firewall install_dir: /var/local/services/firewall

2
group_vars/framadate.yml
View File

@ -1,3 +1,4 @@
---
glob_framadate: glob_framadate:
contact: contact@crans.org contact: contact@crans.org
automatic_response: no-reply@crans.org automatic_response: no-reply@crans.org
@ -8,4 +9,3 @@ glob_framadate:
admin_username: framadate admin_username: framadate
admin_password: "{{ vault.framadate_password }}" admin_password: "{{ vault.framadate_password }}"
db_password: "{{ vault.framadate_password_db }}" db_password: "{{ vault.framadate_password_db }}"

1
group_vars/horde.yml
View File

@ -1,3 +1,4 @@
---
glob_horde: glob_horde:
secret: '{{ vault.horde_secret }}' secret: '{{ vault.horde_secret }}'
imap: imap.adm.crans.org imap: imap.adm.crans.org

2
group_vars/keepalived.yml
View File

@ -8,7 +8,7 @@ glob_keepalived:
VI_ALL: VI_ALL:
password: "{{ vault.keepalived.password }}" password: "{{ vault.keepalived.password }}"
id: 60 id: 60
ipv6: yes ipv6: true
notify: /var/local/services/keepalived/keepalived.py notify: /var/local/services/keepalived/keepalived.py
zones: zones:
- vlan: via - vlan: via

1
group_vars/mirror_backend.yml
View File

@ -1,3 +1,4 @@
---
glob_ftpsync: glob_ftpsync:
root: /mirror/pub root: /mirror/pub
mirror: mirror:

1
group_vars/postgres.yml
View File

@ -1,3 +1,4 @@
---
glob_postgres: glob_postgres:
subnets: subnets:
- 172.16.10.0/24 - 172.16.10.0/24

1
group_vars/radvd.yml
View File

@ -1 +1,2 @@
---
glob_radvd: {} glob_radvd: {}

1
group_vars/reverseproxy.yml
View File

@ -1,3 +1,4 @@
---
loc_certbot: loc_certbot:
- mail: root@crans.org - mail: root@crans.org
certname: crans.org certname: crans.org

1
group_vars/roundcube.yml
View File

@ -1,3 +1,4 @@
---
glob_roundcube: glob_roundcube:
name: Crans name: Crans
imap_server: owl.adm.crans.org imap_server: owl.adm.crans.org

1
group_vars/rsyncd.yml
View File

@ -9,4 +9,3 @@ glob_rsyncd:
path: /pool/mirror/pub/videolan path: /pool/mirror/pub/videolan
comment: VideoLAN repository comment: VideoLAN repository
hosts_allow: "*" hosts_allow: "*"

1
group_vars/server/ntp.yml
View File

@ -1,3 +1,4 @@
---
glob_ntp_client: glob_ntp_client:
servers: servers:
- ntp.adm.crans.org - ntp.adm.crans.org

1
group_vars/sssd.yml
View File

@ -1,3 +1,4 @@
---
glob_sssd: glob_sssd:
primary: primary:
domain: tealc.adm.crans.org domain: tealc.adm.crans.org

1
group_vars/thelounge.yml
View File

@ -1,3 +1,4 @@
---
glob_thelounge: glob_thelounge:
public: "false" public: "false"
host: "undefined" host: "undefined"

1
host_vars/c3po.adm.crans.org.yml
View File

@ -1,2 +1,3 @@
---
interfaces: interfaces:
adm: eth0 adm: eth0

1
host_vars/codichotomie.adm.crans.org.yml
View File

@ -1,3 +1,4 @@
---
interfaces: interfaces:
adm: eth0 adm: eth0
srv_nat: eth1 srv_nat: eth1

2
host_vars/daniel.adm.crans.org.yml
View File

@ -6,5 +6,5 @@ loc_slapd:
loc_postgres: loc_postgres:
version: 11 version: 11
replica: yes replica: true
addresses: "['daniel.adm.crans.org'] + {{ query('ldap', 'ip', 'daniel', 'adm') | ipaddr('address') }}" addresses: "['daniel.adm.crans.org'] + {{ query('ldap', 'ip', 'daniel', 'adm') | ipaddr('address') }}"

4
host_vars/irc.adm.crans.org.yml
View File

@ -79,7 +79,7 @@ loc_inspircd:
ipv6: fd00::10:ff:fe01:2110/128 ipv6: fd00::10:ff:fe01:2110/128
threshold: 10 threshold: 10
commandrate: 10000 commandrate: 10000
modes: yes modes: true
dns: 185.230.79.62 dns: 185.230.79.62
services: services:
name: services.irc.crans.org name: services.irc.crans.org
@ -87,8 +87,6 @@ loc_inspircd:
recvpass: "{{ vault.irc_anope_recvpass }}" recvpass: "{{ vault.irc_anope_recvpass }}"
sendpass: "{{ vault.irc_anope_sendpass }}" sendpass: "{{ vault.irc_anope_sendpass }}"
loc_anope: loc_anope:
recvpass: "{{ vault.irc_anope_recvpass }}" recvpass: "{{ vault.irc_anope_recvpass }}"
sendpass: "{{ vault.irc_anope_sendpass }}" sendpass: "{{ vault.irc_anope_sendpass }}"

2
host_vars/jack.adm.crans.org.yml
View File

@ -6,5 +6,5 @@ loc_slapd:
loc_postgres: loc_postgres:
version: 11 version: 11
replica: yes replica: true
addresses: "['jack.adm.crans.org'] + {{ query('ldap', 'ip', 'jack', 'adm') | ipaddr('address') }}" addresses: "['jack.adm.crans.org'] + {{ query('ldap', 'ip', 'jack', 'adm') | ipaddr('address') }}"

20
host_vars/monitoring.adm.crans.org.yml
View File

@ -1,3 +1,4 @@
---
interfaces: interfaces:
adm: eth0 adm: eth0
srv_nat: eth1 srv_nat: eth1
@ -89,22 +90,3 @@ loc_prometheus:
- source_labels: [instance] - source_labels: [instance]
target_label: __address__ target_label: __address__
replacement: '$1:3903' replacement: '$1:3903'
# apache:
# targets:
# config:
# - job_name: apache
# file_sd_configs:
# - files:
# - '/etc/prometheus/targets_apache.json'
# relabel_configs:
# - source_labels: [__address__]
# target_label: instance
# - source_labels: [instance]
# target_label: __address__
# replacement: '$1:9117'
# bird_targets:
# - routeur-sam.adm.crans.org

1
host_vars/owncloud.adm.crans.org.yml
View File

@ -8,4 +8,3 @@ loc_ldap:
base_dn: "cn=admin,dc=crans,dc=org" base_dn: "cn=admin,dc=crans,dc=org"
password: "{{ vault.ldap_master_password }}" password: "{{ vault.ldap_master_password }}"
uri: "ldap://172.16.10.157" uri: "ldap://172.16.10.157"

4
host_vars/routeur-daniel.adm.crans.org/dhcp.yml
View File

@ -1,9 +1,9 @@
--- ---
loc_dhcp: loc_dhcp:
authoritative: True authoritative: true
subnets: subnets:
- network: "185.230.78.0/24" - network: "185.230.78.0/24"
deny_unknown: True deny_unknown: true
vlan: "adh" vlan: "adh"
default_lease_time: "600" default_lease_time: "600"
max_lease_time: "7200" max_lease_time: "7200"

1
host_vars/routeur-daniel.adm.crans.org/radvd.yml
View File

@ -1,3 +1,4 @@
---
loc_radvd: loc_radvd:
subnets: subnets:
- name: adh - name: adh

8
host_vars/routeur-gulp.cachan-adm.crans.org/dhcp.yml
View File

@ -1,9 +1,9 @@
--- ---
loc_dhcp: loc_dhcp:
authoritative: True authoritative: true
subnets: subnets:
- network: "185.230.76.0/26" - network: "185.230.76.0/26"
deny_unknown: True deny_unknown: true
vlan: "cachan_adh" vlan: "cachan_adh"
default_lease_time: "600" default_lease_time: "600"
max_lease_time: "7200" max_lease_time: "7200"
@ -14,7 +14,7 @@ loc_dhcp:
options: [] options: []
lease_file: "/var/local/services/dhcp/generated/dhcp.cachan-adh.crans.org.list" lease_file: "/var/local/services/dhcp/generated/dhcp.cachan-adh.crans.org.list"
- network: "100.64.0.0/16" - network: "100.64.0.0/16"
deny_unknown: True deny_unknown: true
vlan: "adh_nat" vlan: "adh_nat"
default_lease_time: "600" default_lease_time: "600"
max_lease_time: "7200" max_lease_time: "7200"
@ -25,7 +25,7 @@ loc_dhcp:
options: [] options: []
lease_file: "/var/local/services/dhcp/generated/dhcp.adh-nat.crans.org.list" lease_file: "/var/local/services/dhcp/generated/dhcp.adh-nat.crans.org.list"
- network: "172.16.32.0/22" - network: "172.16.32.0/22"
deny_unknown: True deny_unknown: true
vlan: "infra" vlan: "infra"
default_lease_time: "600" default_lease_time: "600"
max_lease_time: "7200" max_lease_time: "7200"

2
host_vars/routeur-gulp.cachan-adm.crans.org/radvd.yml
View File

@ -18,7 +18,7 @@ loc_radvd:
- 2a0c:700:254::ff:fe00:99fe - 2a0c:700:254::ff:fe00:99fe
- name: infra - name: infra
prefix: fd00:0:0:11::/64 prefix: fd00:0:0:11::/64
no_gateway: yes no_gateway: true
dnssl: infra.crans.org dnssl: infra.crans.org
dns: dns:
- fd00::11:0:ff:fe00:9911 - fd00::11:0:ff:fe00:9911

1
host_vars/routeur-gulp.cachan-adm.crans.org/vars.yml
View File

@ -8,4 +8,3 @@ interfaces:
infra: ens1 infra: ens1
zayo: ens2 zayo: ens2
federez: enp1s3 federez: enp1s3

4
host_vars/routeur-jack.adm.crans.org/dhcp.yml
View File

@ -1,9 +1,9 @@
--- ---
loc_dhcp: loc_dhcp:
authoritative: True authoritative: true
subnets: subnets:
- network: "185.230.78.0/24" - network: "185.230.78.0/24"
deny_unknown: True deny_unknown: true
vlan: "adh" vlan: "adh"
default_lease_time: "600" default_lease_time: "600"
max_lease_time: "7200" max_lease_time: "7200"

1
host_vars/routeur-jack.adm.crans.org/radvd.yml
View File

@ -1,3 +1,4 @@
---
loc_radvd: loc_radvd:
subnets: subnets:
- name: adh - name: adh

4
host_vars/routeur-sam.adm.crans.org/dhcp.yml
View File

@ -1,9 +1,9 @@
--- ---
loc_dhcp: loc_dhcp:
authoritative: True authoritative: true
subnets: subnets:
- network: "185.230.78.0/24" - network: "185.230.78.0/24"
deny_unknown: True deny_unknown: true
vlan: "adh" vlan: "adh"
default_lease_time: "600" default_lease_time: "600"
max_lease_time: "7200" max_lease_time: "7200"

1
host_vars/routeur-sam.adm.crans.org/radvd.yml
View File

@ -1,3 +1,4 @@
---
loc_radvd: loc_radvd:
subnets: subnets:
- name: adh - name: adh

2
host_vars/sam.adm.crans.org.yml
View File

@ -6,5 +6,5 @@ loc_slapd:
loc_postgres: loc_postgres:
version: 11 version: 11
replica: yes replica: true
addresses: "['sam.adm.crans.org'] + {{ query('ldap', 'ip', 'sam', 'adm') | ipaddr('address') }}" addresses: "['sam.adm.crans.org'] + {{ query('ldap', 'ip', 'sam', 'adm') | ipaddr('address') }}"

5
host_vars/tealc.adm.crans.org.yml
View File

@ -1,3 +1,4 @@
---
loc_postgres: loc_postgres:
version: 11 version: 11
hosts: hosts:
@ -22,8 +23,8 @@ loc_postgres:
- {db: constellation-dev, user: constellation-dev} - {db: constellation-dev, user: constellation-dev}
- {db: mailman3, user: mailman3} - {db: mailman3, user: mailman3}
- {db: mailman3web, user: mailman3web} - {db: mailman3web, user: mailman3web}
- { db: all, user: all, subnets: ['127.0.0.1/32','::1/128'], local: yes } - {db: all, user: all, subnets: ['127.0.0.1/32', '::1/128'], local: true}
- { db: replication, user: replication, local: yes } - {db: replication, user: replication, local: true}
addresses: "['tealc.adm.crans.org'] + {{ query('ldap', 'ip', 'tealc', 'adm') | ipaddr('address') }}" addresses: "['tealc.adm.crans.org'] + {{ query('ldap', 'ip', 'tealc', 'adm') | ipaddr('address') }}"
backup: backup:
dir: /var/local/db-backup dir: /var/local/db-backup

1
host_vars/voyager.adm.crans.org.yml
View File

@ -1,3 +1,4 @@
---
interfaces: interfaces:
adm: ens18 adm: ens18
srv_nat: ens19 srv_nat: ens19

1
roles/autoconfig/tasks/main.yml
View File

@ -1,3 +1,4 @@
---
- name: Create base directory - name: Create base directory
file: file:
path: "{{ autoconfig.path }}/mail" path: "{{ autoconfig.path }}/mail"

4
roles/borgbackup-server/tasks/main.yml
View File

@ -11,9 +11,9 @@
- name: Create borgbackup user - name: Create borgbackup user
user: user:
create_home: yes create_home: true
home: '/var/lib/borg/' home: '/var/lib/borg/'
system: yes system: true
state: present state: present
update_password: always update_password: always
name: borg name: borg

2
roles/common-tools/tasks/main.yml
View File

@ -53,7 +53,7 @@
owner: root owner: root
group: utmp group: utmp
mode: '4755' mode: '4755'
check_mode: no check_mode: false
- name: Deploy screen tmpfile - name: Deploy screen tmpfile
template: template:

2
roles/django-cas/tasks/main.yml
View File

@ -17,7 +17,7 @@
git: git:
repo: '{{ django_cas.repo }}' repo: '{{ django_cas.repo }}'
dest: '{{ django_cas.path }}' dest: '{{ django_cas.path }}'
force: yes force: true
version: master version: master
umask: '002' umask: '002'

1
roles/dovecot/tasks/main.yml
View File

@ -1,3 +1,4 @@
---
- name: Install dovecot - name: Install dovecot
apt: apt:
update_cache: true update_cache: true

2
roles/etherpad/handlers/main.yml
View File

@ -4,5 +4,3 @@
name: "{{ item.name }}" name: "{{ item.name }}"
state: restarted state: restarted
loop: "{{ etherpad.instances }}" loop: "{{ etherpad.instances }}"

8
roles/freeradius/tasks/main.yml
View File

@ -44,21 +44,21 @@
src: /var/www/re2o/freeradius_utils/auth.py src: /var/www/re2o/freeradius_utils/auth.py
dest: /etc/freeradius/3.0/auth.py dest: /etc/freeradius/3.0/auth.py
state: link state: link
force: yes force: true
notify: Restart freeradius notify: Restart freeradius
- name: Ensure ${certdir}/letsencrypt directory exists - name: Ensure ${certdir}/letsencrypt directory exists
file: file:
path: /etc/freeradius/3.0/certs/letsencrypt path: /etc/freeradius/3.0/certs/letsencrypt
state: directory state: directory
recurse: yes recurse: true
- name: Symlink radius certificates - name: Symlink radius certificates
file: file:
src: /etc/letsencrypt/live/crans.org/{{ item }} src: /etc/letsencrypt/live/crans.org/{{ item }}
dest: /etc/freeradius/3.0/certs/letsencrypt/{{ item }} dest: /etc/freeradius/3.0/certs/letsencrypt/{{ item }}
state: link state: link
force: yes force: true
loop: loop:
- fullchain.pem - fullchain.pem
- privkey.pem - privkey.pem
@ -68,7 +68,7 @@
path: /etc/letsencrypt/{{ item }} path: /etc/letsencrypt/{{ item }}
group: freerad group: freerad
mode: '0755' mode: '0755'
recurse: yes recurse: true
loop: loop:
- live - live
- archive - archive

4
roles/galene/tasks/main.yml
View File

@ -75,8 +75,8 @@
- name: Enable systemd unit - name: Enable systemd unit
systemd: systemd:
name: galene name: galene
enabled: yes enabled: true
daemon_reload: yes daemon_reload: true
state: started state: started
- name: Indicate role in motd - name: Indicate role in motd

2
roles/inspircd/tasks/main.yml
View File

@ -1,6 +1,4 @@
--- ---
#- name: Install InspIRCd
- name: Deploy InspIRCd configuration - name: Deploy InspIRCd configuration
template: template:
src: "inspircd/{{ item.dest }}.j2" src: "inspircd/{{ item.dest }}.j2"

2
roles/keepalived/tasks/main.yml
View File

@ -56,4 +56,4 @@
name: keepalived name: keepalived
daemon-reload: true daemon-reload: true
state: started state: started
enabled: yes enabled: true

4
roles/linx/tasks/main.yml
View File

@ -3,9 +3,9 @@
- name: Create linx user - name: Create linx user
user: user:
create_home: yes create_home: true
home: /var/lib/linx home: /var/lib/linx
system: yes system: true
state: present state: present
password: "!" password: "!"
update_password: always update_password: always

7
roles/nfs-common/tasks/main.yml
View File

@ -16,11 +16,10 @@
- name: Disable and mask rpcbind.service - name: Disable and mask rpcbind.service
systemd: systemd:
name: rpcbind.service name: rpcbind.service
enabled: no enabled: false
masked: yes masked: true
- name: - name:
systemd: systemd:
name: rpcbind.socket name: rpcbind.socket
masked: yes masked: true

2
roles/ntp-server/tasks/main.yml
View File

@ -12,7 +12,7 @@
path: /etc/default/ntp path: /etc/default/ntp
regexp: '^NTPD_OPTS' regexp: '^NTPD_OPTS'
line: NTPD_OPTS='-g -x' line: NTPD_OPTS='-g -x'
check_mode: no check_mode: false
- name: Configure NTP - name: Configure NTP
template: template:

1
roles/policyd/tasks/main.yml
View File

@ -1,3 +1,4 @@
---
- name: Install policyd-rate-limit - name: Install policyd-rate-limit
apt: apt:
update_cache: true update_cache: true

2
roles/prometheus-node-exporter/handlers/main.yml
View File

@ -6,4 +6,4 @@
- name: systemctl daemon-reload - name: systemctl daemon-reload
systemd: systemd:
daemon_reload: yes daemon_reload: true

2
roles/prometheus-node-exporter/tasks/main.yml
View File

@ -40,7 +40,7 @@
- name: systemctl daemon-reload - name: systemctl daemon-reload
systemd: systemd:
daemon_reload: yes daemon_reload: true
when: override.changed when: override.changed
- name: Activate prometheus-node-exporter service - name: Activate prometheus-node-exporter service

2
roles/re2o-ldap-replica/tasks/main.yml
View File

@ -103,7 +103,7 @@
regexp: '^SLAPD_SERVICES=' regexp: '^SLAPD_SERVICES='
line: 'SLAPD_SERVICES="ldap:/// ldaps:/// ldapi:///"' line: 'SLAPD_SERVICES="ldap:/// ldaps:/// ldapi:///"'
notify: Restart slapd notify: Restart slapd
check_mode: no check_mode: false
- name: Touch installation marker - name: Touch installation marker
when: not installation.stat.exists when: not installation.stat.exists

2
roles/slapd/tasks/main.yml
View File

@ -32,4 +32,4 @@
regexp: '^SLAPD_SERVICES=' regexp: '^SLAPD_SERVICES='
line: 'SLAPD_SERVICES="ldaps://{{ slapd.ip }}/ ldapi:///"' line: 'SLAPD_SERVICES="ldaps://{{ slapd.ip }}/ ldapi:///"'
notify: Restart slapd notify: Restart slapd
check_mode: no check_mode: false

6
roles/statping/tasks/main.yml
View File

@ -3,13 +3,13 @@
unarchive: unarchive:
src: https://github.com/statping/statping/releases/download/v0.90.74/statping-linux-amd64.tar.gz src: https://github.com/statping/statping/releases/download/v0.90.74/statping-linux-amd64.tar.gz
dest: /usr/local/bin/ dest: /usr/local/bin/
remote_src: yes remote_src: true
- name: Create statping user - name: Create statping user
user: user:
create_home: yes create_home: true
home: /var/lib/statping home: /var/lib/statping
system: yes system: true
state: present state: present
password: "!" password: "!"
update_password: always update_password: always